chore: update submodule refs, add plan files

.sisyphus/evidence/task-1-wg-gogo2.txt

@@ -0,0 +1,23 @@
+# gogo2 (10.172.21.2) AllowedIPs Evidence
+# Public Key: Akp/KlNcbN3xe6nZ3Icfn/HVJQ4ueRHPIxlQOCUwTwM=
+#
+# === STATE TIMELINE ===
+# BASELINE (before fix):
+#   allowed ips: 10.172.21.0/24  <-- already correct from prior setup
+#
+# AFTER IMMEDIATE FIX:
+#   allowed ips: 10.172.21.0/24  <-- re-set and confirmed
+#
+# === OBSERVATION ===
+# gogo2's AllowedIPs was already set to 10.172.21.0/24 in the baseline.
+# gogo2 has is_active=false in the DB (per inherited wisdom).
+# The server-core sync DOES NOT touch gogo2 (it likely queries only
+# active devices, and gogo2 is excluded).
+#
+# After setting AllowedIPs manually, gogo2 STAYS set across multiple
+# verification cycles (1s, 3s, 10s, 30s).
+#
+# === VERIFICATION COMMANDS ===
+# ssh root@172.20.8.191 'wg show wg0 | grep -A 4 "Akp/KlNcbN3xe6nZ3Icfn/HVJQ4ueRHPIxlQOCUwTwM="'
+# Expected:  allowed ips: 10.172.21.0/24
+# Actual:    allowed ips: 10.172.21.0/24  ✓ STABLE